Senior Product Security Engineer - Secure SDLC

Oscar is the first health insurance company built around a full-stack technology platform, driven by a mission to make healthcare simple, accessible, and member-focused.

As a Senior Product Security Engineer 1, you will serve as a key technical leader securing Oscar’s software development life cycle (SDLC) from design through production deployment. Working at the intersection of traditional application security and modern AI-driven engineering, you will secure development "paved roads," architect defensive systems, and design security frameworks for AI agent workflows that bypass traditional ticketing channels.

Key Responsibilities

• Vulnerability Lifecycle Management: Drive the end-to-end vulnerability management lifecycle—combining automated SAST/DAST tooling with manual code analysis and remediation tracking.
• AI Integration & Security: Design and implement security measures for AI-driven workflows and agent integration, including protocols like the Model Context Protocol (MCP).
• Architecture & Secure SDLC: Partner with core engineering to architect, build, test, and deploy secure application infrastructure, authentication systems, and security libraries.
• Source Code Review & Development: Conduct manual and automated source code reviews across internal and third-party codebases, while writing production-ready security libraries for developer use.
• Risk Assessment & Mentorship: Build actionable risk assessment frameworks for complex engineering initiatives while providing technical mentorship to junior security engineers.
• Engineering Enablement: Deliver technical security presentations, advise engineering teams on vulnerability remediation, and ensure compliance with healthcare regulations.

Requirements

Experience & Technical Background

• 4+ years of combined professional experience in software engineering and application/information security.
• Demonstrated hands-on experience securing all stages of the Secure Software Development Life Cycle (SDLC).
• Proven track record of architecting and building moderate-to-complex standalone systems or major platform security features.
• Practical experience utilizing AI models and integrating them with internal engineering systems via protocols like the Model Context Protocol (MCP) or custom APIs.

Mindset & Soft Skills

• Ability to simplify intricate security concerns into clear, actionable technical requirements for engineering teams.
• Strong technical leadership, collaboration, and mentorship capabilities.

Bonus Qualifications

• Bachelor’s degree in Computer Science, Cybersecurity, or 4 years of equivalent practical experience.
• Prior experience with healthcare data compliance (HIPAA, HITRUST) or domain knowledge of health insurance technology challenges.

Workplace Model & Benefits

• Hybrid Schedule: 3 days/week in the NYC office (Thursdays required for team meetings; 2 flexible days).
• Total Compensation: Base salary ($163,944 – $215,176/yr) + company equity grants + annual performance bonus.
• Benefits: Unlimited vacation program, medical/dental/vision coverage, 401(k), paid parental leave, paid holidays, and wellness reimbursements.